The present invention relates to the art of Internet security and the authentication of otherwise unknown users or individuals. It finds particular application in conjunction with Internet based access/communication of confidential and/or personal records (e.g. medical records, financial records, governmental records, etc.), and will be described with particular reference thereto. However, it is to be appreciated that the present invention is also amenable to other like applications where it is desirable to positively identify the user or individual accessing the records to ensure that confidential and/or personal data is not improperly released to unauthorized requesters. For example, the invention is equally applicable to commercial transactions where it is desirable to positively identify the purchaser or good or services.
The Internet is an electronic communications network useful for transferring data or information. For example, many individuals or users find it advantageous to communicate, exchange data and/or conduct transactions with various entities, vendors, information providers and the like having a presence on the Internet, e.g., governmental and law enforcement agencies, law offices, hospitals, doctor offices, dental offices and other medical facilities, banks and financial institutions, credit card companies, insurance organizations, credit bureaus, pharmacies, retail stores, etc. For purposes herein, the foregoing will be referred to generally as vendors.
The various entities or vendors often maintain databases containing personal records of citizens, clients, patrons, patients, account holders, individuals or other like users associated with the entity or vendor. Accordingly, as the entities or vendors have a presence on the Internet and they maintain the respective databases of personal records, the Internet is a convenient vehicle for accessing and communicating personal data or information (e.g., governmental records, medical or dental records, pharmaceutical record, financial records, voting records, records of commercial transactions, legal records, insurance record, etc.) to an authorized requester.
However, the Internet is, to a significant degree, unsecure. Data or information transferred or accessed over an unsecure communications network is vulnerable to unauthorized capture and/or use. This is particularly troublesome when the data or information, such as that mentioned above, is personal and/or highly confidential in nature. Accordingly, Internet security directed to protecting confidential personal information from fraudulent or unauthorized access/communication is desired. For example, it is desirable to authenticate a user's identity prior to fulfilling a request for confidential information to ensure that the user is in fact authorized to access the information. Likewise, for commercial transactions, it is advantageous to authenticate a user's identity to ensure they are authorized to use the account from which payment is to be made.
Security has heretofore been limited in the foregoing area. For example, many entities or vendors have separate disparate security measures and/or authentication protocols. This is inconvenient and unduly repetitive for users which desire access to and/or confidential information from a plurality of distinct entities or vendors. A multitude of disparate protocols and security measures results in the users having to maintain numerous distinct passwords, IDs, electronic keys and/or other security software or devices, often, a different one for each entity or vendor. Moreover, some entities or vendors may use four character passwords which are capitalization sensitive while others may use eight character passwords which are capitalization independent. There is no standard authentication protocol among the various entities and vendors having a presence on the Internet. This makes keeping track of the various protocols and remembering the various security passwords and IDs even more difficult for users. Additionally, the various entities and vendors are each separately authenticating users' identities. This is unduly repetitive and inefficient, especially considering that the entity or vendors' core competency is not likely to include identity authentication.
The present invention contemplates a new and improved centralized authentication system and technique for carrying out transactions and granting access to personal information over a communications network that overcomes the above-referenced problems and others.